Nixpkgs security tracker

Login with GitHub

Suggestions search

All statuses
Filter by:
With package: networkmanager-l2tp

Found 2 matching suggestions

View:
Compact
Detailed
Published
Permalink CVE-2026-19624
7.8 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 6 hours ago by @LeSuisse Activity log
  • Created suggestion 10 hours ago
  • @LeSuisse ignored
    16 packages
    • fedora-backgrounds.f32
    • fedora-backgrounds.f33
    • fedora-backgrounds.f34
    • fedora-backgrounds.f35
    • fedora-backgrounds.f36
    • fedora-backgrounds.f37
    • fedora-backgrounds.f38
    • haskellPackages.fedora-krb
    • haskellPackages.fedora-dists
    • haskellPackages.fedora-releases
    • python313Packages.python-fedora
    • python314Packages.python-fedora
    • python313Packages.fedora-messaging
    • python314Packages.fedora-messaging
    • haskellPackages.fedora-haskell-tools
    • gnomeExtensions.fedora-linux-update-indicator
    6 hours ago
  • @LeSuisse accepted 6 hours ago
  • @LeSuisse published on GitHub 6 hours ago
NetworkManager-l2tp: local privilege escalation via ipsec.conf injection

A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive; pluto executes that command as root when the IKE security association is established, resulting in local privilege escalation. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc).

Affected products

NetworkManager-l2tp
  • <1.20.24
  • <1.8.10
  • <1.2.22
  • <1.0.16
  • <1.52.4

Matching in nixpkgs

Ignored packages (16)

Package maintainers

Untriaged
Permalink CVE-2026-19685
7.1 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
created 3 weeks ago Activity log
  • Created suggestion 3 weeks ago
Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)

NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.

Affected products

NetworkManager

Matching in nixpkgs